jP d dl mZ d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dl Z d dl
Z
d dl Z d dl Z d dl
m
Z
mZmZ d dlmZmZmZmZ d dlmZ d dlmZmZ d d lmZ d d
l m Z d d l m Z m Z m!Z! d d l"m#Z# d d
l$m%Z% d dl&m'Z' ddl(m)Z) ddl*m+Z+ dZ,dZ-d>dZ.d?dZ/d Z0d Z1d Z2d Z3d Z4d Z5d Z6d@d Z7d>d Z8ej9 ej: z ej; z ej9 ej: z ej; z ej9 ej: z ej< z ej9 ej: z ej< z d Z=d>d!Z>dAd#Z?dAd$Z@d% ZAd& ZBd' ZCd( ZDd) ZEd* ZFd+ ZGdBd.ZHd/ ZId0 ZJd1 ZKdCd3ZLd4 ZMd5 ZN dDd6ZOd7ePd8eQfd9ZRd:ePfd;ZSd< ZTd= ZUdS )E )print_function)absolute_import)divisionN)time monotonicsleep)AnyStrListDictOptional)Path)urlparse
urlunparse) resolve_username_and_doc_root)CP_NAME)NoDomain NotSupported
IncorrectData) mod_makedirs)init_sentry_client)get_pkg_version )clprint)ClSelectExceptz/sbin/cagefs_enter_userzehttps://9713d1296f804031b058b8f2d789d7ac:8ddacae32d8246cf8b25cf826bf3fc0a@cl.sentry.cloudlinux.com/12c t j | t d t j t j d|d }| \ }}nA# t t f$ r-}t j | d t | d}~ww xY w|j dk r/t j |pdd
| d| |S ) z
Runs external process and returns output
:param cmd: command and arguments as a list
:param env_data
:return string
/dev/nullT)stdinstdoutstderr close_fdsenvtextr Nzoutput of the command:
)
subprocessPopenopenPIPESTDOUT communicateOSErrorIOErrorr FileProcessErrorstr
returncodeExternalProgramFailedjoin)cmdenv_dataoutputstd_outstd_erres E/opt/cloudlinux/venv/lib64/python3.11/site-packages/clselect/utils.py run_commandr9 ) s >! {## ? $
"--// W > > > -c!fc!ff===>
A 2 Q Q#((3----Q
Ns AA B'(BBc
D t j | t d t j t j |d|| }| \ }}nA# t
t f$ r-}t j | d t | d}~ww xY w|j
||fS )a
Runs external process and returns output.
Differs from subprocess.check_output, run_command above, and check_output below in that it does not
throw an exception if process's return code != 0
:param cmd: command and arguments as a list
:param env_data
:param preexec_fn: Pre-exec function. None if don't need
:param cwd: Directory name to set as current
:return Cortege: (ret_code, stdout, stderr)
r T)r r r
preexec_fnr cwdr! r N) r% r& r' r( r* r+ r, r r- r. r/ )r2 r3 r; r< processr5 r6 r7 s r8 run_command_fullr> D s
> " {## ? ?!
#..00 W > > > -c!fc!ff===> w //s AA B((BBc d} t | }| }| n# t t f$ r Y nw xY w|S )z8
Reads file contents and returns it as a string
)r' readcloser+ r, )filenamedefaults_contentsfs r8 read_file_as_stringrF ` sb
NN FFHH W
s 7< AAc t | i | d S N) check_output)argskwargss r8
check_callrL n s $!&!!!!! c | dd }| d }| dd }| dd }|r| |z
} |d= t j d | t j t j dd|}nA# t
t f$ r-}t j | d t | d}~ww xY w|
\ }} |r)| | | ||
|j rt j |p| p| |S )
av
check_output(val1, val2, val3, arg4=val4)
equivalent
check_output(args=(val1, val2, val3), arg4=val4)
or equivalent
check_output(val1, args=(val2, val3), arg4=val4)
DON'T USE check_output((val1, val2, val3), arg4=val4)
:param tuple *args: arguments for command line
:param dict **kwargs: parameters for subprocess.Popen
:return str:
errorNrJ r4 waitT)rJ r r r" r )popgetr% r& r( r+ r, r r- r. r* writerB rP r/ r0 )
rJ rK rO args_from_kwargsr4 rP pr7 r r s
r8 rI rI r sN
JJw % %E zz&))
ZZ$
'
'F ::fd # #D 6N? l$zz]a l lek l l W ? ? ? -d1gs1vv>>>?]]__NFF
V | N 253LF3LfMMM Ms #*B C (CC c D fdt j D S )Nc g | ]A}t j t j | ?|BS rQ )ospathisdirr1 ).0drZ s r8
z list_dirs.. s< P P P!27== dA9N9N+O+O PA P P PrM )rY listdirrZ s `r8 list_dirsra s' P P P Prz$'' P P PPrM c
# K | V |D ]M\ }}| t | z V |D ]1}| d t t ||f z V 2Nd S )N.)r. r1 map)rZ versionsmajorminorsminors r8
versioningri s
JJJ! < <
vSZZ < ":":;;; ; ; ; ; << A)wwbaabc t | }n6# t $ r) t d|dt t d w xY wt j | |t j z t j z d }t j ||| S )zqOpen `path` for writing with O_NOFOLLOW on the leaf so a
symlinked target is refused instead of dereferenced.z-file_write/file_writelines: unsupported mode z (expected one of )i r ) _MODE_TO_OS_FLAGSKeyError
ValueErrorsortedrY r'
O_NOFOLLOW O_CLOEXECfdopen)rZ r r flagsfds r8 _open_no_follow_writer s H!$' H H Hj&*ddF3D,E,E,E,E
GH H HH
ur},r|;U C CB
9Rf - - --s
3Ar c t | || } | | | dS # | w xY wzN
write litle data to file and close
:param path:
:return str:
r N)r rT rB )rZ liner r r s r8
file_writer sR #4f
=
=
=F T ? Ac t | || } | | | dS # | w xY wr )r
writelinesrB )rZ linesr r r s r8 file_writelinesr sT #4f
=
=
=F% r c t j d dk r+t j d dk r| | S | |d }t | dk r|d ||d f}n |d ddf}|S )z
str.partition for all python versions
:param s: string to parse
:param sep: separator to split by
:return: cortege - see str.partition function for python 2.5+
r r r@ )sys version_info partitionsplitrx )srv s_parts ret_corteges r8 s_partitionr
s a C$4Q$71$<$<{{3 ggc1ooG
7||q qz3
3 qz2r* rM c t |d }n# t $ r Y dS w xY wd}t j | }|D ] }| | r|dz
} | |S )z"
find regex count in file
r Nr r )r' r, recompilesearchrB )patternrZ rE counterregexr s r8 grepr s sOO tt G Jw E << qLGGGIII Ns
!!c $ ddl m} || S )z
Determines is user should be skipped in selectorctl work
:param username: user name to check
:return: True - user should be skipped, False - not
r )is_admin)clcommon.cpapir )usernamer s r8 user_should_be_skippedr 2 s( (''''' 8H rM c t j | se t | d d S # t t
f$ r>}t
d| dt | t j d Y d }~d S d }~ww xY wd S )Ni zError: failed to create:r )
rY rZ r[ r r, r+ printr. r exit)dest_dirr7 s r8 make_dirr > s
7== " " 5 ) ) ) ) )! +XsCFF C C C HQKKKKKKKKK s 3 B3A==Bc t j | n# t $ r Y nw xY wt j | rt j | d d S d S )NT)rY unlinkr+ rZ r[ shutilrmtreer` s r8 remove_file_or_dirr G sn
$
w}}T "
dD!!!!!" "s
$$c t j | rEt j | | k r+t j | t j | | d S d S t
| t j | | d S # t $ r@}t d|d| dt | t j d Y d }~d S d }~ww xY w)Nz Error: failed to create symlinkz->r r ) rY rZ islinkreadlinkr symlinkr r+ r r. r r )srcdstr7 s r8 make_symlinkr P s
7>># !{3 3&& #
3$$$$$ '&
s # # # JsC
/dCc!ffMMM s A B &$B
C5CCc 2 t j | ddd S )N ),z: T)indent
separators sort_keys)jsondumps)r s r8 pretty_jsonr ^ s :d1 M M MMrM r" Fc | }d} t | | \ }}n# t $ rC t j |dd | | d t j d Y nt $ r: |rn4t j |ddt z d t j d Y nAt $ r5 t j |dd|d | d t j d Y nw xY w||fS )
a
Safely resolve username and doc_root by domain,
or resolve document root by username,
or resolve document root and username by effective uid
:param pass_not_supported_panel: pass not supported panel for php selector
:param msg_format: error messages' format (json or text)
:param user: str -> name of unix user
:param domain: str -> domain of panel user
:return: tuple -> user, doc_root
N)ry domainERRORz(No domain found for user: {}, domain: {})statusmessager z6NodeJs/Ruby/Python selector not supported for %s panelzDomain z is not owned by the user )
r r r
print_diagformatr r r r r )ry r
msg_formatpass_not_supported_panel result_userresult_doc_roots r8 $safely_resolve_username_and_doc_rootr c sW KO'D(
(
(
$ __ 77a7h7himou7v7vww
# "/gjq/qrr
HQKKK 77bhbhbhjnjn7opp
''s A
C''A C');C'&C'c t | | d }|D ](}t | | d }||k r
|| c S )t d | )a
Transform all directories to realpath, compare and return config value
:param user: str -> unix user - owner of the config
:param directory: str -> wanted directory key
:param config: dict -> config to get value from,
should have directories as keys
r %Config does not contain directory: {})r~ r r )ry rz config
abs_directoryconf_dir abs_conf_dirs r8 get_using_realpath_keysr s{ i003M $ $"42215 L ( ((# # # # ) :AA)LL
M
MMrM c t | | d }d}t | }|D ]#}t | | d }||k r||= d}$|s"t d | dS )a
Transform all directories to realpath, compare and remove directory key
:param user: str -> unix user - owner of the config
:param directory: str -> wanted directory key
:param config: dict -> config to remove key from,
should have directories as keys
r FTr N)r~ listkeysr r )ry rz r r removed_at_least_one config_keysr r s r8 delete_using_realpath_keysr s i003M v{{}}%%K ( ("42215 L ( (x #' R>EEiPPQQQR RrM c ^ t | | d t | | d k S )a#
Checks that two paths in user home directory are the same after
stripping symlinks
:param user: Unix user whose home directory contains both paths
:type path1: str
:type path2: str
:return: True if paths are canonically the same otherwise False
:rtype: bool
r )r~ )ry path1path2s r8 realpaths_are_equalr s- tU # #A &+dE*B*B1*E EErM @c t |z } t j | d n3# t $ r&}|j t j k rY d}~dS Y d}~dS d}~ww xY wt |k rdS t
d n)z;Wait until a killed session can no longer run account code.Tr NFg?)r rY killpgr+ rl ESRCHr )pidtimeoutdeadlinern s r8 _wait_for_process_group_exitr s {{W$H Ic1 yEK''ttttt55555 ;;( " "5
d s *
AAAc t j | d n# t $ r Y dS w xY w t j | t j n# t $ r Y nw xY wt | dS )zBKill descendants left in the session after its direct child exits.r N)rY r r+ signalSIGKILLr )r s r8 _kill_remaining_process_groupr s
#q
#v~&&&&
%%%%%s
&& A
AAc z t j | j t j n# t
$ r Y nw xY w | d }t | j nX# t j $ rF t | j | d }n# t j $ r d}Y nw xY wY nw xY w|S )z>Stop a timed-out child and every process still in its session.r r )r@ r@ )
rY r r r SIGTERMr+ r* r r% TimeoutExpired)r= r4 s r8 _terminate_process_groupr s
'+v~....
3$$Q$// &gk2222 $ %gk222 (((33FF( FFF MsA $'
44A# ##B8B B8 B2/B81B22B87B8c , i }|si }t | |g|z }t |t j t j d }|d|d< t j |fi |}d} || \ }
} n| | \ }
} n)# t j $ r d} t | \ }
} Y nw xY w| rdn|j } |
s,| dk r&d | d
t d }
n|
}
|
|d < | |d
< | rdnd|d< |S )z=
Run any process using the utility cagefs_enter_user
T)r! r r r" Nstart_new_sessionFr | zUser's process "{}" failed and didn't return anything. It could mean that user has too small limit of PMEM for running of cloudlinux-selector. Please, increase the limit to user and try run process againrO )detailsresult timestampr4 r/ failed) CAGEFS_ENTER_USER_BINdictr% r( r& r* r r r/ r r strip)
ry path_to_utilityargs_for_utilityenv_varsr r r2
popen_argsr= timed_outr _retcodes
r8 run_process_in_cagefsr sz F $
8;K
KC(:? '_49 9 9J +/
&' s11j11GI6 ? ++--IFAA ++G+< t j fd}|S )z
Drops to user
c t j dk rt j g t j j t j j t j d< j t j d< d S )Nr USERHOME) rY geteuid setgroupssetgidpw_gidsetuidpw_uidenvironrt )ry user_pwds r8 funczdemote..funcT sj :<<1 L
(/"""
(/""" !
6 %_
6rM )rr rs )ry r9 r8 s ` @r8 demoter: N s: |D!!H
-
-
-
-
-
- KrM c l d }d}|D ](} | |g|R i |}|dz }# |$ r } | }Y d } ~ !d } ~ ww xY w|s||S )NFTrQ )
r9 usersexception_typerJ rK caught_exception
is_handled
user_aliasr r7 s
r8 apply_for_at_least_one_userrA f s J
T*6t666v66F
$ JJ ! ! ! !
Ms -(-c t | }d|j v r1|j dd }| | }t | S )a
Transforms a URL containing a wildcard ('*') in the netloc.
If the netloc of the URL contains a '*', it replaces the '*' with 'any'.
This is necessary because URLs with wildcards are not valid for HTTP requests.
Replacing '*' with 'any' ensures compatibility with systems or libraries
that do not support wildcards in URLs.
:param url: str - The URL to transform.
:return: str - The transformed URL with the wildcard replaced.
*any)netloc)r rE r _replacer )urlparsedrE s r8 transform_wildcard_urlrI x sT c]]F
fm &&sE22 // f rM rH )NNN)r N)r N)NNr" F)r )NN)V
__future__r r r rl rY rr r r% r r r r r r r typingr r
r r pathlibr
urllib.parser r clcommon.clpwdr r r clcommon.cpapi.cpapiexceptionsr r r clcommon.utilsr clsentryr clsentry.utilsr
clselectprintr clselectexceptr r r r9 r> rF rL rI ra ri ro r~ r r O_WRONLYO_CREATO_TRUNCO_APPENDr r r r r r r r r r r r r r r r r r r r. boolr, r: rA rI rQ rM r8 rZ sh & % % % % % & & & & & &
' ' ' ' ' ' ' ' ' ' / / / / / / / / / / / / - - - - - - - - 8 8 8 8 8 8 " " " " " " P P P P P P P P P P ' ' ' ' ' ' ' ' ' ' ' ' * * * * * * " " " " " " * * * * * * 2 s 60 0 0 08 " " " DQ Q Q< < < *
rz !BJ .
+
"RZ
/ rz !BK /
+
"R[
0
.
.
.
.
$ & " " " N N N
'( '( '( '(TN N N"R R R(
F
F
F"
&
&
& * MQ"&0 0 0 0f$S $T $ $ $ $N 0 $ rM